New QPACK Flaws Expose HTTP/3 Servers to Denial-of-Service and Memory Amplification

Security researchers have disclosed multiple vulnerabilities affecting QPACK, the header compression protocol used in HTTP/3, which can allow unauthenticated remote attackers to trigger severe denial-of-service conditions. According to a disclosure by security firm FoxIO, the flaws permit memory amplification factors of up to 4,000 times under specific conditions, potentially crashing vulnerable servers with a minimal volume of incoming traffic.

FoxIO reported discovering vulnerabilities in seven out of ten HTTP/3 implementations tested. The underlying issue stems from how affected stacks handle the decompression of request headers. While implementations properly cap the size of compressed data arriving over the network, they fail to appropriately limit or check the size of the headers after they are unpacked, or they enforce limits too late in the processing cycle.

Mechanics of the Vulnerability and Amplification

HTTP/3 relies on QPACK to compress request headers so that repeated fields can be transmitted as short codes rather than full text strings. Under normal operations, a receiving server is expected to strictly limit the memory consumed by headers after unpacking them.

However, affected software implementations allow a single small batch of compressed headers to expand into hundreds of thousands of individual entries in server memory. FoxIO identified two primary methods used to achieve this amplification:

• Direct Expansion: Sending small batches that expand significantly upon unpacking, leading to resource exhaustion.
• Reference Multiplying: Storing a small header entry (around 4 KB) and referencing it thousands of times using single-byte pointers, forcing the server to rebuild the full entry repeatedly. FoxIO measured memory amplification between 600 and 1,800 times on lsquic, and up to 4,000 times on Bun.

Because HTTP/3 operates over UDP, incoming requests can reach the target server before traditional TCP-based filtering mechanisms can evaluate them. The vulnerabilities exclusively result in denial-of-service outcomes; researchers found no evidence of data theft, arbitrary code execution, or exploitation in the wild.

Affected Software and Status

As of October 22, 2026, the status of various HTTP/3 stacks and related tools varies significantly:

• Patched: Fixes have been released for `quic-go` (the Go library utilized by Caddy, Traefik, and cloudflared), Cloudflare's `quiche`, LiteSpeed's `lsquic` library, and Wireshark.
• Unpatched at Disclosure: Bun, the `h3` Rust library, and `aioquic` were identified as unpatched when the findings were made public. Notably, Bun's experimental HTTP/3 server uses `lsquic` but replaces the header memory capping logic with custom code that omits running totals, leading to integer overflows and 100 percent CPU loops when memory reaches 2 GB.
• Not Affected: IIS, Envoy, `ngtcp2`/`nghttp3`, and Google's `quiche` implementations were found to be unaffected because they enforce strict memory caps on unpacked headers during the decoding process.
• Wireshark Specifics: Wireshark's issue impacts its HTTP/3 dissector when decrypting traffic using key-log files or processing capture files containing decryption secrets, resulting in a crash of the analysis tool rather than a network-reachable server failure.

Practical Implications and Verification

System administrators and operators running HTTP/3 infrastructure must review their dependencies to determine exposure. Because HTTP/3 is enabled by default in many modern web servers and proxy configurations, identifying the underlying libraries (such as `quic-go` or LiteSpeed) is critical.

Confirmed Facts:

• Unauthenticated remote attackers can trigger memory exhaustion using single connections.
• The vulnerability class stems from inadequate post-decompression memory enforcement in QPACK implementations.
• Official patches or mitigations exist for several major libraries, while others require temporary configuration changes.

Unknowns and Uncertainties:

• The complete list of every downstream application utilizing unpatched transitive dependencies may require manual auditing by system owners.
• Exact amplification factors can vary depending on specific server configurations and default settings.

Recommended Actions: Operators should immediately upgrade affected software packages to the latest vendor-supplied releases. For environments utilizing unpatched software, interim workarounds include disabling HTTP/3 entirely (such as passing `--set http3=false` in `mitmproxy`), avoiding the exposure of experimental HTTP/3 endpoints (as in Bun), or configuring strict limits like `max_field_section_size` in the `h3` Rust library.

Readers can verify technical details, exact patch versions, and advisory updates by reviewing the original disclosure published by FoxIO and checking advisories from individual software maintainers, starting with the primary reporting available at [The Hacker News](https://thehackernews.com/2026/10/new-qpack-flaws-can-crash-http3-servers.html).